PT-2022-18843 · Jenkins · Jenkins Proxmox Plugin+1

Daniel Beck · Published 2022-03-29 · Updated 2023-11-17 · CVE-2022-28144

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Proxmox Plugin version 0.7.0 and earlier

Description The issue allows attackers with Overall/Read permission to connect to a specified host using a specified username and password, and perform a connection test. This also enables them to disable SSL/TLS validation for the entire Jenkins controller JVM as part of the connection test, and test a rollback with specified parameters.

Recommendations For Jenkins Proxmox Plugin version 0.7.0 and earlier, consider disabling the plugin until a patch is available to prevent attackers from exploiting the lack of permission checks in several HTTP endpoints. Restrict access to the plugin's functionality to minimize the risk of exploitation. Avoid using the plugin for connection tests until the issue is resolved.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-28144

GHSA-2MGJ-MWVF-MPG5

Affected Products

Jenkins

Jenkins Proxmox Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-28144 · Security Note
• https://jenkins.io/security/advisory/2022-03-29/#SECURITY-2082 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-28144 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2mgj-mwvf-mpg5 · Vendor Advisory
• https://t.me/cvenotify/60604 · Telegram Post
• http://openwall.com/lists/oss-security/2022/03/29/1 · Note